Convincing Deepfakes

Convincing Deepfakes

A familiar voice on the phone or a recognizable face on a video call used to offer some reassurance that you knew who you were dealing with. AI has changed that. Voice cloning, face swaps, and real-time video impersonation now allow scammers to convincingly pose as executives, job candidates, romantic interests, or even family members. Understanding how these attacks work and where they may be headed is a central part of Tom Cross's work as Head of Threat Research at GetReal Security. Tom has spent more than 30 years studying cybersecurity threats, software vulnerabilities, and the methods attackers use to exploit technology. Before joining GetReal Security, he held leadership roles at IBM X-Force, Lancope, and Drawbridge Networks, and he has shared his research at major security conferences including Black Hat and DEF CON. His current work focuses on deepfake-enabled social engineering and the development of tools that can detect digital impersonation, including signs that are often too subtle for a person to recognize. In this episode, we learn how little audio is needed to clone someone's voice, why live video is no longer reliable proof of identity, and how deepfakes are being used in romance scams, investment fraud, identity theft, and remote hiring schemes. We also talk about AI agents that can carry on persuasive conversations, adjust their behavior based on a victim's reactions, and repeat those tactics on a massive scale. The discussion offers a revealing look at why familiar advice for spotting fakes is quickly becoming outdated and what individuals and organizations will need to do differently as the technology improves. Show Notes: * [01:05] Tom shares how his early work in vulnerability research led to a career studying sophisticated cybersecurity threats. * [03:32] Running a bulletin board system as a teenager helped spark an enduring interest in hacking and computer security. * [06:11] A look back at early online communities, text-based games, Fidonet, and the pre-internet era. * [09:36] The conversation shifts to deepfake research and the technology being developed to detect manipulated media. * [11:29] Deepfakes are divided into audio, visual, file-based, and real-time forms, each creating different risks. * [15:20] Modern voice clones can fool both people and biometric authentication systems, making specialized detection increasingly important. * [18:30] Virtual backgrounds and other subtle processing artifacts may reveal manipulation even when nothing looks obviously wrong. * [20:31] Deepfake detection has become another cybersecurity arms race as attackers continually improve their methods. * [22:30] Romance scams, investment fraud, remote job schemes, and identity theft are among the growing uses of deepfake technology. * [25:26] Scammers succeed by exploiting desires, expectations, and the human tendency to rationalize warning signs. * [27:56] Large-scale phishing and business email compromise attacks only need a small percentage of targets to respond. * [29:22] Criminal compounds in Southeast Asia use trafficked workers and deepfake tools to conduct scams on a massive scale. * [30:27] North Korean remote workers may use stolen identities and shared deepfake personas to secure jobs at American companies. * [33:45] Purpose-built criminal software combines face swapping with appearance-enhancing features designed for romance scams. * [35:05] Common visual tests for identifying deepfakes are becoming unreliable as the technology advances. * [39:24] Emotional investment makes detection even harder because people often explain away signs that something is wrong. * [40:47] Building authentication into the internet could help people determine whether digital content is genuine. * [42:13] AI agents may soon conduct automated scams that respond naturally, apply pressure, and adjust to a victim's behavior. * [45:14] Automation could allow criminals to target hundreds of thousands of people while making impersonation increasingly convincing. * [46:22] Machine learning may create self-improving scams that test countless variations and concentrate on the tactics that work. * [49:18] AI lowers the technical barrier to cybercrime by helping people create tools they could not build on their own. * [51:06] Phones and messaging platforms may eventually require stronger controls as automated calls and texts become more common. * [53:09] Digital signatures, watermarks, and verified content could help distinguish malicious deepfakes from authorized uses. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * GetReal Security [https://www.getrealsecurity.com/] * Tom Cross - LinkedIn [https://www.linkedin.com/in/tom-cross-/]

When Trust Becomes a Trap

Most people use technology all day without giving much thought to what is happening behind the screen. We trust routers that may not have been updated in years, depend on internet systems few of us understand, and now turn to artificial intelligence for everything from travel plans to home repairs. That convenience comes with tradeoffs. In this episode, we look at the weaknesses built into our connected world and what happens when our technical knowledge fails to keep pace with the technology surrounding us. Sherrod DeGrippo leads threat intelligence for Unit 42 at Palo Alto Networks, where she oversees teams working to identify and respond to increasingly complex cyber threats. During more than two decades in information security, she has held senior leadership roles at Microsoft and Proofpoint, along with positions at Nexum, Symantec, Secureworks, and the National Nuclear Security Administration. Sherrod was named Cyber Security Woman of the Year in 2022 and regularly shares her expertise at industry conferences and through outlets including BBC News, The Wall Street Journal, CNN, and The New York Times. She is also the author of *Threat Driven Software Development: Defending Modern Online Services*. We discuss how outdated home routers become tools for criminal and nation-state attacks, what could happen as technical knowledge disappears, and why foundational internet systems may be more vulnerable than people realize. Sherrod also explains why the greatest danger from AI may not be a dramatic technological disaster, but the gradual loss of human connection as people choose frictionless answers over real conversations. Along the way, she shares practical examples of where AI genuinely helps, where its limits become obvious, and why slowing down still matters when emotion or urgency begins driving a decision. Show Notes: * [01:48] Sherrod introduces herself and traces her 23-year career from government network security to threat intelligence. * [03:00] An early lesson in buffer overflows sparked a lasting interest in both hacking and protecting systems. * [05:10] Growing up around AT&T gave Sherrod firsthand experience with telephone networks, copper lines, and beige boxing. * [08:17] Technology has shifted from something people opened and explored into consumer devices few people truly understand. * [11:24] As technical knowledge disappears, the people who understand how systems actually work are becoming increasingly rare. * [13:41] Older internet users often understood where their data traveled, while today's devices constantly communicate in the background. * [16:22] Network security remains critical because once malicious traffic reaches a device, the problem has already become much larger. * [17:57] Outdated home routers provide an attractive attack surface for criminals and foreign governments. * [20:12] The conversation turns to the fragility of DNS, internet protocols, and the systems supporting the global network. * [22:13] Chris shares his experience with denial-of-service attacks and seeing legitimate online services exploited by malware. * [25:48] Sherrod explains why AI's greatest danger may be the gradual loss of human relationships rather than a dramatic physical threat. * [29:23] AI works well for tedious tasks, but human connection, creativity, and judgment should not be handed over so easily. * [31:35] Living intentionally means deciding what experiences matter instead of allowing technology or other outside forces to decide for us. * [34:10] Frictionless technology may leave people more vulnerable to scams by training them to expect immediate and effortless results. * [35:33] Social engineering uses modern tools, but manipulation, espionage, and theft have existed for thousands of years. * [38:14] AI may eliminate certain jobs while also giving people more time to focus on customers, relationships, and other human-centered work. * [40:44] A furnace repair shows how AI can guide basic troubleshooting and reduce the need for some professional diagnostic visits. * [43:08] AI can help someone become competent in many areas, but having access to it does not make anyone an expert. * [45:44] Used intentionally, AI can remove unwanted planning and create more opportunities for people to spend time together. * [47:18] Strong prompts, detailed skill files, and personalized instructions may become more valuable than traditional prompt engineering. * [49:10] A gift card scam demonstrates how fear and urgency can push someone to ignore repeated warnings from others. * [51:30] Sherrod advises pausing whenever a strong emotion begins driving an unusual financial or personal decision. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Sherrod DeGrippo [https://sherrod.im/] * Sherrod DeGrippo - LinkedIn [https://www.linkedin.com/in/sherroddegrippo/] * Palo Alto Networks Unit 42 [https://unit42.paloaltonetworks.com/] * Threat Driven Software Development: Defending Modern Online Services [https://www.amazon.com/dp/0135567386]

Scam Compounds

When most people think about online scams, they picture criminals sitting behind a screen and stealing from victims around the world. But in Southeast Asia, many of the people sending those messages are victims too. Some were promised legitimate jobs, flown across borders, trapped inside guarded compounds, and forced to scam others while trying to survive. In this episode, I talk with Ivan Franceschini, a lecturer in Chinese Studies at the Center for Contemporary Chinese Studies Asia Institute. After years of studying labor rights, civil society, and Chinese investment in Cambodia, Ivan's work led him to the online scam industry and the cybercrime compounds that have spread across Southeast Asia. He is the co-author of Scam: Inside Southeast Asia's Cybercrime Compounds, and through the EOS Collective, he and his colleagues also help support people who have been trafficked into these operations. I talk with Ivan about how small scam operations grew into large compounds, why COVID helped the industry expand, and how fake job offers are used to recruit people from around the world. We also talk about the blurred line between victim and criminal, the local economies that grow around these compounds, and what happens when people escape or are left stranded without money, documents, or a safe way home. Show Notes: * [01:27] Ivan Franceschini explains how his academic background in China studies and labor rights eventually led him to research scam compounds in Southeast Asia. * [04:39] Early scam operations in Cambodia started as smaller setups in villas, apartments, and hotels before expanding into large, organized compounds. * [07:53] COVID becomes a major turning point as isolation, financial desperation, and new technology help the online scam industry grow rapidly. * [10:42] The industry expands beyond Chinese-speaking networks and begins recruiting people from many countries, including large numbers from Africa. * [13:29] Criminal groups, businesspeople, local elites, and trafficking networks all play different roles in keeping the scam compound industry running. * [15:50] Fake job offers are used to recruit people from abroad, with many victims believing they are traveling for legitimate work in customer service, teaching, sales, or other fields. * [18:19] Recruiters use believable salaries and convincing explanations to lure people who may be desperate for work or unfamiliar with the region. * [21:43] Many trafficked workers are not highly trained scammers, but poor or vulnerable people who are taught scripts, given tools, and assigned small parts of the scam process. * [24:05] Language barriers are no longer a major obstacle because scammers can use translation tools, AI tools, and backstories that make mistakes seem believable. * [26:40] Scam compounds become embedded in local economies through guards, cleaners, restaurants, construction workers, delivery services, and other support jobs. * [31:22] Getting out of a compound can involve paying a ransom, escaping physically, or risking a message to an embassy, family member, NGO, or government official. * [33:40] Some trapped workers are able to ask for help online, but contacting authorities can also be dangerous if local police alert the compound operators. * [35:17] Crackdowns in Cambodia have left many people stranded without money, valid visas, housing, or a safe way to return home. * [37:27] Survivors released from compounds may end up sleeping on the street, begging for food, and trying to find help while facing fines and deportation barriers. * [40:14] Survivor support often means meeting immediate needs such as food, basic medical care, and flights home for people who have nowhere else to turn. * [41:29] Ivan explains that sanctions and enforcement need to consider the human beings inside the industry, not just the money and criminal networks behind it. * [42:49] Survivors often have valuable information about trafficking networks, scam techniques, and specific operations, but that intelligence is lost when they are abandoned. * [45:15] Verifying survivor stories requires interviews, embassy coordination, compound maps, cross-checking details, and recognizing that victim and criminal roles can overlap. * [48:53] Ivan shares where people can find his book, Scam: Inside Southeast Asia's Cybercrime Compounds, and learn more about the EOS Collective's work. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Ivan Franceschini - LinkedIn [https://www.linkedin.com/in/ivan-franceschini-1414004/] * Scam: Inside Southeast Asia's Cybercrime Compounds [https://www.amazon.com/Scam-Inside-Southeast-Cybercrime-Compounds-ebook/dp/B0DJQC55MM] * EOS Collective [https://eoscollective.net/]

Sports Betting

Sports betting is everywhere now. It is in the commercials, on the apps, wrapped into game broadcasts, and sold as a fun way to make sports more exciting. But behind the easy sign-ups and "risk-free" offers is an industry built on odds most people do not fully understand, fine print that can cost real money, and a business model that depends on customers losing. In this episode, I talk with Danny Funt, an investigative reporter and the author of Everybody Loses: The Tumultuous Rise of American Sports Gambling. His reporting on sports betting, politics, news, and sports media has appeared in The Washington Post, The New Yorker, The Wall Street Journal, Columbia Journalism Review, and other publications. Through his work, Danny has taken a close look at how legal sports betting expanded so quickly in the United States and what that boom has meant for everyday customers. I talk with Danny about misleading promotions, why "risk-free" bets are not always what they sound like, and how betting apps encourage people to remember their wins while downplaying their losses. Danny also explains why the customers who actually win can be limited or pushed away, while big spenders who lose heavily may be rewarded with VIP perks and personal attention. This episode is a closer look at the gap between the fun, harmless image of sports betting and the way the industry really works. Show Notes: * [01:20] Danny Funt introduces his work as an investigative reporter and explains how his book, Everybody Loses, examines the rapid rise of legal sports betting in America. * [03:57] A "risk-free" betting promotion turns out to be much more complicated than it sounds, leaving customers with bonus bets instead of a simple refund. * [05:25] The fine print behind bonus bets shows how customers can still lose real money, even when the offer is marketed as safe or risk-free. * [07:26] Legal sports betting has grown from a Nevada-based industry into a massive national business, with billions wagered every year across dozens of states. * [10:00] Easy access through phone apps, constant advertising, and in-game micro bets have changed how people engage with sports and gambling. * [12:21] Sportsbooks often highlight customer wins while downplaying losses, creating a distorted picture of how much money people are actually losing. * [15:59] Misleading promotions and advertising claims make betting look like a real way to profit from sports knowledge, even though very few people win long term. * [20:03] Customers who show signs of being skilled or profitable can be restricted or limited, which contradicts the message that anyone can win. * [21:51] The difference between prediction markets and sportsbooks helps explain why sportsbooks care so much about who wins and who loses. * [26:24] VIP programs for high-spending customers go far beyond casino perks, offering exclusive sports experiences and personal attention to keep people betting. * [28:19] Personal relationships between VIP hosts and customers can blur ethical lines, especially when big losers are treated like valued friends. * [34:17] Unlike bars that are expected to cut off visibly drunk customers, sportsbooks often have no clear requirement to intervene when betting behavior becomes dangerous. * [37:14] State lawmakers are beginning to consider tighter regulation, but tax revenue and industry lobbying make meaningful reform difficult. * [41:24] Industry insiders acknowledge the tension between protecting customers and maximizing profits, with many suggesting real change will require legislation. * [43:37] Professional bettors and industry critics are pushing back by warning people how difficult it really is to win and how risky the current betting culture has become. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Danny Funt [https://dannyfunt.com/] * Everybody Loses: The Tumultuous Rise of American Sports Gambling [https://www.simonandschuster.com/books/Everybody-Loses/Danny-Funt/9781668062029] * Danny Funt - Facebook [https://www.linkedin.com/in/danny-funt-2695b4a3/] * Danny Funt - Instagram [https://www.instagram.com/dannyfunt/]

Google Maps Scams

Most people are not thinking clearly when they need a locksmith or a plumber. They are locked out, water is leaking, something broke, and they just want somebody nearby who can fix it. So they open Google, tap one of the first businesses that comes up, and assume the listing is real. Unfortunately, that is exactly the kind of situation scammers count on. In this episode, Mike Blumenthal, co-founder and analyst at Near Media, talks about fake local business listings and the ways bad actors have learned to game Google Maps. Mike has been following this problem for years, going back to the early days of map spam, when locksmiths were creating fake listings all over major cities. We learn how listings can look legitimate with complete addresses, phone numbers, and reviews without actually existing. We also talk about what regular people can actually do about it. Mike explains why it helps to keep a short list of trusted local businesses before an emergency happens, and what to watch for if you do have to search online at the moment. A generic phone greeting, mismatched company names, fake-looking reviews, or an unmarked truck can all be warning signs. Show Notes: * [1:08] Mike Blumenthal shares how losing his family business led him into SEO, local search, and eventually years of work focused on Google Maps and local digital marketing. * [3:47] Early Google Maps abuse showed up in a big way when locksmiths created thousands of fake listings across Manhattan to capture emergency service calls. * [6:28] Fake listings can work especially well on mobile because Google's local results often favor businesses that appear to be physically close to the person searching. * [9:13] Map spam creates real harm for legitimate businesses and consumers, including in a recent plumbing case tied to millions of dollars in alleged consumer losses. * [12:04] Consumers can protect themselves by checking more than one platform, looking for consistent branding, and being cautious when hiring emergency service providers. * [15:22] Reports can be made to Google, the FTC, or state attorneys general, but fake listing problems are not always fixed quickly or easily. * [18:46] The Premier Plumbing case shows how troubling the problem still is, with thousands of fake listings allegedly created despite years of known abuse in local search. * [21:37] Real local businesses should not depend entirely on Google and need to build direct customer relationships through email, text, repeat service, and trust. * [24:42] Small customer service details, from professional arrival to respecting someone's home, can make a major difference in whether people trust and recommend a business. * [28:04] Pressure-based reviews can mislead consumers, especially when customers feel pushed to leave positive feedback or mention specific employees by name. * [31:24] Review volume alone does not prove a business is trustworthy because reviews can be fake, pressured, incentivized, or difficult to judge at a glance. * [33:19] Stressful emergencies make people more vulnerable to scams because they are trying to solve an urgent problem quickly and may not stop to verify the business. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes [https://podcasts.apple.com/us/podcast/easy-prey/id1488678905] and leave a nice review. Links and Resources: * Podcast Web Page [https://www.easyprey.com/] * Facebook Page [https://www.facebook.com/EasyPreyPodcast] * whatismyipaddress.com [https://whatismyipaddress.com/] * Easy Prey on Instagram [https://www.instagram.com/easypreypodcast/] * Easy Prey on Twitter [https://twitter.com/easypreypodcast] * Easy Prey on LinkedIn [https://www.linkedin.com/company/easy-prey-podcast/] * Easy Prey on YouTube [https://www.youtube.com/channel/UCCgy_xKrjiXghSgGFEAFdTQ] * Easy Prey on Pinterest [https://www.pinterest.com/easypreypodcast/] * Mike Blumenthal [https://blumenthals.com/blog/about-mike-blumenthal/] * Near Media [https://www.nearmedia.co/]